Opencart

Opencart

46 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.8

CVE-2020-29470

Exploit
  • EPSS 1.69%
  • Veröffentlicht 29.12.2020 17:15:12
  • Zuletzt bearbeitet 21.11.2024 05:24:03

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, th...

3.5

CVE-2020-28838

Exploit
  • EPSS 0.38%
  • Veröffentlicht 11.12.2020 15:15:12
  • Zuletzt bearbeitet 21.11.2024 05:23:10

Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.

4.8

CVE-2020-13980

Exploit
  • EPSS 0.66%
  • Veröffentlicht 09.06.2020 14:15:10
  • Zuletzt bearbeitet 21.11.2024 05:02:17

OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The ven...

5.4

CVE-2020-10596

Exploit
  • EPSS 2.67%
  • Veröffentlicht 17.03.2020 15:15:14
  • Zuletzt bearbeitet 21.11.2024 04:55:40

OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.

4.8

CVE-2019-15081

Exploit
  • EPSS 1.96%
  • Veröffentlicht 15.08.2019 15:15:15
  • Zuletzt bearbeitet 21.11.2024 04:28:00

OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.

8.8

CVE-2018-13067

Exploit
  • EPSS 0.72%
  • Veröffentlicht 02.07.2018 17:29:00
  • Zuletzt bearbeitet 21.11.2024 03:46:20

/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.

4.9

CVE-2018-11495

Exploit
  • EPSS 1.7%
  • Veröffentlicht 26.05.2018 20:29:00
  • Zuletzt bearbeitet 21.11.2024 03:43:29

OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the download_id. For example, an attacker can download ../../config.php.

8

CVE-2018-11494

Exploit
  • EPSS 2.38%
  • Veröffentlicht 26.05.2018 20:29:00
  • Zuletzt bearbeitet 21.11.2024 03:43:29

The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a s...

9.8

CVE-2014-3990

Exploit
  • EPSS 6.87%
  • Veröffentlicht 20.03.2018 21:29:00
  • Zuletzt bearbeitet 21.11.2024 02:09:17

The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via...

7.2

CVE-2016-10509

Exploit
  • EPSS 1.41%
  • Veröffentlicht 31.08.2017 20:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_...